APD/GBA (Belgium) - 128/2023

APD/GBA - 128/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12(3) GDPR Article 12(4) GDPR Article 15 GDPR Article 15(1) GDPR Article 17 GDPR Article 17(1) GDPR Article 58(2)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	02.08.2023
Decided:	05.09.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	128/2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	Autorité de protection des données (in FR)
Initial Contributor:	Enzo Marquet

The Belgian DPA ordered a controller to comply with an access request under Article 15(1) GDPR and an erasure request under Article 17(1) GDPR, after the controller failed to facilitate the requests.

English Summary

Facts

On 10 June 2023, the data subject received an email from a real estate agent (the controller). On the same day, the data subject replied to this email requesting explicilty for the controller to notify him of (a) the person or company who transmitted his data, and (b) requested that all of the data related to him be erased. The controller did not respond to the data subject. The controller claimed to have received the data subject's information from a source they knew but refused to disclose, and instead stressed that every email included the option to opt-out.

On 2 August 2023, the data subject filed a complaint with the Belgian DPA.

Holding

The DPA made an order under Article 58(2)(c) for the controller to comply with the data subject's requests under Article 15(1) GDPR and Article 17(1) GDPR.

Firstly, Article 15(1) GDPR provides data subjects with the right to access personal data concerning them and infromation relating to it, from a controller In particular, Article 15(1)(g) provides that a data subject is entitled to information concerning the source of data "where personal data are not collected form the data subject..."

Secondly, Article 17(1) GDPR establishes the right of erasure, which grants data subjects the right to request that all data concerning them are erased by the controller.

Lastly, the DPA concluded a prima facie breach of Article 15 GDPR and Article 17 GDPR in combination with Article 12(3) GDPR and Article 12(4) GDPR, because the controller did not facilitate the request for data access and erasure.

Article 12(3) GDPR provides a time limit of 1 month for controllers to facilitate requests made under Articles 15 - 22 GDPR, and Article 12(4) GDPR notes that if the controller does not take action within the prescribed time frame, they must inform the data subject of why they did not take action and the data subject's ability to lodge a complaint with a supervisory authority. The controller did neither, thus the DPA additionally found a breach of Articles 12(3) and 12(4) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/7



                                                                        Litigation Chamber


                                                   Decision 128/2023 of September 5, 2023


File number: DOS-2023-03274


Subject: Complaint relating to the lack of reaction to a request for access and erasure

carried out as part of a real estate canvassing



The Litigation Chamber of the Data Protection Authority, made up of Mr.

Hielke H IJMANS, president;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the

protection of natural persons with regard to the processing of personal data and

to the free movement of these data, and repealing Directive 95/46/EC (General Regulation on the

data protection), hereinafter “GDPR”;

Having regard to the Law of December 3, 2017 establishing the Data Protection Authority, hereinafter

“ACL”;


Considering the internal regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;

Considering the documents in the file;



Has taken the following decision regarding:


The complainant: .

                                                                                                         .

The defendant: LAGENCE Y, hereinafter: “the defendant”. . Decision 128/2023 — 2/7



I. Facts and procedure


 1. On August 2, 2023, the complainant filed a complaint with the Data Protection Authority.

       data (hereinafter “the DPA”) against the defendant, an agency specializing in the market

       real estate for expatriates in Brussels and its surroundings.

 2. The subject of the complaint concerns the lack of reaction to an access and erasure request

       carried out as part of a real estate canvassing.


 3. On June 10, 2023, the plaintiff receives an email from the defendant in his inbox

       private. This email concerns the rental of your property, identified under the reference

       “…”. This communication is part of a direct canvassing for the rental of

       the plaintiff's apartment. The defendant claims to have collected information about

       potentially interesting goods for its customers, as well as information on
       individuals with whom she would have already collaborated. According to the defendant, the name of the complainant would have

       been quoted by a source known to them, without disclosing the identity of this source. Moreover,

       the defendant emphasizes that the complainant can express his desire to no longer be contacted

       by responding to the same email.


 4. In the context of the complaint, the complainant specifies that he did not make public the rental listing

       of his property, with the exception of a publication on a Facebook group (without mention of his

       mail) and on a professional intranet of an unspecified institution. The approach of the

       defendant surprises him, because she should not have known this information.

 5. Still on June 10, 2023, the plaintiff responded to the defendant by raising two questions;

       He explicitly asks the defendant to reveal the person or company who

       transmitted his data, and he demands that all data concerning him be erased

       immediately. According to the plaintiff, the defendant did not respect the legal deadline of 30

       days to provide an adequate response to his request.


 6. On August 9, 2023, the complaint was declared admissible by the Front Line Service (hereinafter
                                                             1
       “SPL”) on the basis of Articles 58 and 60 of the LCA and the complaint is transmitted to the Chamber
                                                              2
       Litigation under Article 62, § 1 of the LCA.



II. Motivation


 7. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the principles
       of data protection contained in the GDPR and other laws containing

       provisions relating to the protection of the processing of personal data.



1
 Under article 61 LCA, the Litigation Chamber informs the parties by this decision of the fact that the complaint has been declared
2Pursuant to article 95, § 2 LCA, by this decision, the Litigation Chamber informs the parties of the fact that following this complaint,
the file was sent to him. Decision 128/2023 — 3/7



 8. Pursuant to Article 33, § 1 of the LCA, the Litigation Chamber is the body for

       administrative litigation of the APD. It receives complaints that the SPL forwards to it in

       application of Article 62, § 1 of the LCA, i.e. admissible complaints. In accordance with

       Article 60 paragraph 2 of the LCA, complaints are admissible if they are drawn up in one

       national languages, contain a statement of the facts and the information necessary to

       identify the processing of personal data to which they relate and which

       fall under the jurisdiction of the APD.

 9. Pursuant to articles 51 et seq. of the GDPR and article 4, § 1 of the LCA, it is up to the

       Litigation Chamber as an administrative litigation body of the APD, to exercise

       effective control of the application of the GDPR and to protect freedoms and rights

       fundamentals of natural persons with regard to the processing and to facilitate the free flow

       personal data within the Union.


 10. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the order regulations

       internal to the DPA, a copy of the file may be requested by the parties. If one of

       parties wish to make use of the possibility of consulting the file, they are required to

       contact the secretariat of the Litigation Chamber, preferably via the address

       litigationchamber@apd-gba.be.


 11. Based on the facts described in the complaint file as summarized above, and on

       the basis of the powers assigned to it by the legislator under article

       95, § 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the complaint, in
       the occurrence to order the defendant, in accordance with article 58.2.c) of the GDPR and

       Article 95, § 1, 5° of the LCA, to comply with the request of the person concerned

       to exercise their rights, more precisely the right of access and the right to erasure, introduced

       by the complainant on June 10, 2023, in accordance with Articles 15.1 and 17.1 of the GDPR; And this,

       for the reasons set out below.


 12. The Litigation Chamber takes into consideration the grievance raised by the complainant regarding

       the lack of response from the defendant to its request for access (aimed at obtaining

       the identity of the individuals and/or entities having shared their personal data) as well as its

       request for erasure; both exercised on June 10, 2023, in accordance with articles

       15.1 and 17.1 of the GDPR, following the receipt of an email sent by the defendant to

       purposes of “direct marketing” (hereinafter “the disputed email”).




3
 APD, Recommendation No. 01/2020 of January 17, 2020 relating to the processing of personal data for marketing purposes
direct, p. 8, available on the APD website. The GDPR does not define what is meant by “direct marketing” (prospecting).
its interpretation of this legal concept in recommendation no. 01/2020: “Any communication, solicited or unsolicited, aimed at
promotion of an organization or person, services, products, whether paid or free, as well as brands or
of ideas, addressed by an organization or person acting in a commercial or non-commercial context, directly to one or more
several natural persons in a private or professional context, by any means, involving the processing of data
personal character. » By “direct marketing”, we therefore mean several forms of promotion, such as email newsletters,
commercial telephone calls, text messages or emails or online advertising, whether in a commercial or non-commercial context. Decision 128/2023 — 4/7



 13. Article 4(7) of the GDPR defines the “data controller” as “the person

       physical or legal entity, public authority, service or other body which, alone or
                                                                                                 4
       jointly with others, determines the purposes and means of the processing.


 14. The Litigation Chamber recalls that the data controller must follow up on the request

       request made pursuant to articles 15 to 22 of the GDPR by the data subject,

       in this case a request for access provided for by Article 15 of the GDPR and for erasure provided for

       by article 17 of the GDPR, and in compliance with the conditions set out in article 12 of the GDPR. 5


 15. Under Article 12.1 of the GDPR, it is up to the data controller to “take

       appropriate measures to provide any information referred to in Articles 13 and 14 as well as

       to make any communication under Articles 15 to 22 and Article 34 with regard to


       concerns the processing of the data subject in a concise, transparent manner,

       understandable and easily accessible, in clear and simple terms [...]. ".


 16. The Litigation Chamber also emphasizes that it is the responsibility of the data controller

       to provide the data subject with information on the measures taken following a

       request made in application of articles 15 to 22 of the GDPR, as soon as possible and

       in any event within one month of receipt of the request. 6

       Article 12.3 of the GDPR provides that this period may, if necessary, be extended by two months,

       given the complexity and number of requests. In such a case, the person responsible


       processing informs the data subject of this extension and the reasons for the postponement
                                                                             8
       within one month of receipt of the request.


 17. In the event that the data controller does not respond to the request made

       by the person concerned, he informs him without delay and at the latest within one

       months from receipt of the request of the reasons for its inaction and the possibility

       to lodge a complaint with a supervisory authority and lodge an appeal

       jurisdictional.


 18. On the basis of the documents supporting the complaint, the Litigation Chamber finds that the complainant

       effectively exercised its rights of access and erasure on June 10, 2023, in accordance with

       to Articles 15.1 and 17.1 of the GDPR, in response to the disputed email received on the same date. Of


       Furthermore, the Litigation Chamber notes that the complainant submitted his complaint to the DPA on 2

       August 2023, thus exceeding the response times allocated to the controller in

       under Articles 12.3 and 12.4 of the GDPR. Furthermore, it is relevant to note that the grievances



4According to Article 4, 2) of the GDPR, a "processing" of personal data means "any operation or set of operations
whether or not carried out using automated processes and applied to personal data or sets of personal data, such as
as the collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation,
use, communication by transmission, dissemination or any other form of provision, reconciliation or interconnection,
limitation, erasure or destruction”.
5GDPR, art. 12.
6GDPR, art. 12.2 and 12.3.
7GDPR, art. 12.3.
8GDPR, art. 12.3.
9GDPR, art. 12.4. Decision 128/2023 — 5/7


       expressed in his response to the disputed email are in all respects consistent with those

       presented in its complaint filed with the DPA. Finally, the Litigation Chamber

       emphasizes that if the defendant had fully complied with the requirements set out in


       Article 12 of the GDPR, it would have taken into account the request for access and erasure. This

       approach would have potentially prevented the complainant from initiating proceedings before the DPA.

 19. Following the aforementioned analysis, the Litigation Chamber considers that the defendant


       may have violated the following provisions: Articles 15 and 17 of the GDPR,

       combined with articles 12.3 and 12.4 of the GDPR; what justifies making a prima facie decision

       facie by the Litigation Chamber in accordance with Article 95 of the LCA, more specifically

       Article 95, §1, 5° of the LCA, in response to the complaint filed by the complainant, within the framework

       of the “procedure prior to the substantive decision” 10 and not a decision on the merits of the

       Litigation Chamber within the meaning of article 100 of the LCA.


 20. The purpose of this decision is to inform the defendant, presumed responsible for the

       processing, of the possibility of a possible violation of the provisions of the GDPR, in order to

       offer the opportunity to comply with the aforementioned provisions.


 21. If, however, the defendant does not agree with the content of this decision

       prima facie and considers that it can put forward factual and/or legal arguments which

       could lead to another decision, it may address to the Litigation Chamber a

       request for processing on the merits of the case via the email address litigationchamber@apd-

       gba.be, within 30 days of notification of this decision. The case

       where applicable, the execution of this decision is suspended for the period

       mentioned above.


 22. In the event of continued processing of the case on the merits, under Articles 98, 2° and 3°

       juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their

       conclusions and attach to the file all the documents they consider useful. If applicable, the

       this decision is permanently suspended.


 23. With a view to transparency, the Litigation Chamber finally emphasizes that a

       dealing with the case on the merits may lead to the imposition of the measures mentioned in

       section 100 of the ACL .1




1Section 3, Subsection 2 of the ACL (sections 94 to 97 inclusive).
1Art. 100. § 1. The litigation chamber has the power to
 1° dismiss the complaint without follow-up;
 2° order the dismissal;
 3° pronouncing the suspension of the pronouncement;
 4° to propose a transaction;
 5° issue warnings and reprimands;
 6° order to comply with requests from the data subject to exercise his or her rights;
 7° order that the person concerned be informed of the security problem;
 8° order the freezing, limitation or temporary or permanent prohibition of processing;
 9° order compliance of the processing;
 10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the data;
 11° order the withdrawal of accreditation from certification bodies;
 12° to issue periodic penalty payments; Decision 128/2023 — 6/7


III. Publication of the decision


 24. Given the importance of transparency regarding the decision-making process of the Chamber

       Litigation, this decision is published on the website of the Protection Authority

       Datas. However, it is not necessary for this purpose that the identification data

       of the parties are communicated directly.




     FOR THESE REASONS    ,


     the Litigation Chamber of the Data Protection Authority decides, subject to

     the introduction of a request by the defendant for treatment on the merits

     in accordance with articles 98 e.s. of the LCA:

        - under article 58.2.c) of the GDPR and article 95, § 1, 5° of the LCA, to order

            the defendant to comply with the request of the person concerned

            to exercise their rights, more precisely the right of access which implies the revelation of

            the identity of the individuals and/or entities who shared the person’s data

            concerned, as well as the right to erasure, requiring the deletion of said


            data, and this within 30 days from the date of notification of this

            decision ;

        - to order the defendant to inform the Data Protection Authority by e-mail

            data (Litigation Chamber) of the follow-up given to this decision, in

            the same deadline, via the email address litigationchamber@apd-gba.be; And


        - if the defendant does not comply in a timely manner with what is requested of it above

            above, to deal ex officio with the case on the merits, in accordance with articles 98 e.s. of

            the LCA.




In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days from its notification, to the Court of Markets (court

of Appeal of Brussels), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the
                                                                 12
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be


 13° to issue administrative fines;
 14° order the suspension of cross-border data flows to another State or an international body;
 15° transmit the file to the public prosecutor of the King of Brussels, who will inform it of the action taken in the file;
 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.
1The request contains under penalty of nullity:
 (1) indication of the day, month and year;
 2° the name, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or number
     business;
 3° the surname, first name, address and, where applicable, the status of the person to be summoned;
 4° the object and summary of the grounds of the request;
 5° indication of the judge who is seized of the request;
 6° the signature of the applicant or his lawyer. Decision 128/2023 — 7/7



filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 13

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).








(sé). Hielke H IJMANS

President of the Litigation Chamber







































































13
  The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by registered letter to
clerk of the court or filed with the registry.